最新FCKEditor ASP上传绕过漏洞

admin

exploiut-db：

+ D6 n1 L- I$ g3 m7 m( ?8 ZFCKEditor ASP Version 2.6.8 File Upload Protection Bypass
4 q4 f3 ^, K6 B1 d
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
5 y5 r0 h2 R6 i9 W+ u- Link:http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is
dealing with the duplicate files. As a result, it is possible to bypass
( n* Q) I" j+ N% C6 P  sthe protection and upload a file with any extension.
0 Y- A# ^' `2 N# q$ A8 \1 U. K- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC:http://www.youtube.com/v/1VpxlJ5 ... ;rel=0&vq=hd720
"
. U$ C* Q* E( @. ?- V$ LNote: Quick patch for FCKEditor 2.6.8 File Upload Bypass:
3 }% I$ }9 y7 F. X4 bIn “config.asp”, wherever you have:
% h' `5 v+ T; T8 {+ h9 O. V      ConfigAllowedExtensions.Add    “File”,”Extensions Here”
9 F6 h% E# T8 }5 I  yChange it to:
      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
# I" A4 a) J5 T* s) P
2 m. s4 i0 G6 g, `) c2 l9 O& w
2 r  O2 s. C4 u


: I5 P* t% _" S7 B  C6 Y% d/ @1 r! Yphp测试无效
6 x1 l6 M, P; _  Lasp/aspx测试成功：
来到/FCKeditor/editor/filemanager/connectors/test.html
) n9 p7 p: p( `1 F* _8 B6 p因为结合了之前二次上传的漏洞，所以先上传任意内容的文件：asd.asp.txt

+ B" f8 `) F8 O- x* `burpsuite上传包并修改，repeater
名字改为asd.asp%00txt    然后把%00专为URL编码上传后得到asd(1).asp
2 i% P  B9 g4 s5 \. r" a
如图，webshell为：http://localhost/userfiles/file/asd(1).asp
3 m8 \( W. C+ R, {  N2 s